From 993a4dd5892fd9e986573b21b3d94d93d37e2f3b Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Tue, 28 Jul 2026 00:06:38 +0200
Subject: [PATCH] Register user-engine portal OIDC client

---
 config/dev-config.yaml                        |  7 +++
 ...-WP-0007-user-engine-portal-oidc-client.md | 57 +++++++++++++++++++
 2 files changed, 64 insertions(+)
 create mode 100644 workplans/KEY-WP-0007-user-engine-portal-oidc-client.md

diff --git a/config/dev-config.yaml b/config/dev-config.yaml
index e6ca0f3..96ef3fa 100644
--- a/config/dev-config.yaml
+++ b/config/dev-config.yaml
@@ -37,3 +37,10 @@ clients:
     allowedScopes: ["openid", "profile", "email", "groups"]
     grantTypes: ["authorization_code"]
     clientType: "public"
+  - clientId: "user-engine-portal"
+    displayName: "User Engine Portal"
+    redirectUris:
+      - "https://users.92-205-62-239.nip.io/oidc/callback"
+    allowedScopes: ["openid", "profile", "email", "groups"]
+    grantTypes: ["authorization_code"]
+    clientType: "public"
diff --git a/workplans/KEY-WP-0007-user-engine-portal-oidc-client.md b/workplans/KEY-WP-0007-user-engine-portal-oidc-client.md
new file mode 100644
index 0000000..a0cbc4d
--- /dev/null
+++ b/workplans/KEY-WP-0007-user-engine-portal-oidc-client.md
@@ -0,0 +1,57 @@
+---
+id: KEY-WP-0007
+type: workplan
+title: "User-engine portal OIDC relying-party integration"
+domain: infotech
+repo: key-cape
+status: active
+owner: codex
+topic_slug: netkingdom
+created: "2026-07-27"
+updated: "2026-07-27"
+depends_on:
+  - KEY-WP-0005
+  - USER-WP-0020
+---
+
+# KEY-WP-0007 - User-engine portal OIDC relying-party integration
+
+Register and prove the reusable user-engine portal as a strict KeyCape public
+client. This is the authentication edge required by `NK-WP-0023-T03`; it does
+not move user-domain or authorization ownership into KeyCape.
+
+## Register the static portal client
+
+```task
+id: KEY-WP-0007-T01
+status: progress
+priority: high
+```
+
+Register `user-engine-portal` for authorization code with mandatory S256 PKCE,
+exact callback URIs and only `openid profile email groups`. No wildcard,
+implicit flow, client secret, or dynamic registration is allowed.
+
+## Deploy and verify the live client
+
+```task
+id: KEY-WP-0007-T02
+status: wait
+priority: high
+```
+
+Update the railiance01 KeyCape configuration without exposing its signing key
+or backend credentials. Verify discovery, authorize redirect validation,
+unregistered callback denial and successful token exchange through the portal.
+
+## Prove claims and MFA isolation
+
+```task
+id: KEY-WP-0007-T03
+status: wait
+priority: high
+```
+
+Prove issuer, audience, tenant, groups, roles and assurance claims are verified
+by the portal and that tenant administration does not imply platform-root.
+Complete the Binky user/MFA acceptance through the reusable browser path.